The vulnerability stems from improper IP validation in proxy environments using IPv6. The core issue involves two key functions: 1) checkIPAllowDeny, responsible for enforcing IP-based access rules, which failed to properly verify if the client IP (from X-Forwarded-For) was allowed when behind an authorized proxy. 2) getClientIp, which likely mishandled IPv6 address parsing from headers. This is supported by the patched commits modifying IP validation logic and the vulnerability's nature (CWE-661 - Improper Enforcement of Authorization Rules). The confidence is high as the vulnerability directly maps to IP handling functions in the authentication workflow.